From: Greg Kroah-Hartman Date: Sat, 2 May 2015 16:48:34 +0000 (+0200) Subject: 3.14-stable patches X-Git-Tag: v3.10.77~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2ca6ef91843bf818568e362b6a6724044662f1c7;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: acpi-scan-annotate-physical_node_lock-in-acpi_scan_is_offline.patch acpica-utilities-split-io-address-types-from-data-type-models.patch asoc-davinci-evm-drop-un-necessary-remove-function.patch bluetooth-ath3k-add-support-atheros-ar5b195-combo-mini-pcie-card.patch clk-qcom-fix-rcg-m-n-counter-configuration.patch clk-tegra-register-the-proper-number-of-resets.patch dm-crypt-fix-deadlock-when-async-crypto-algorithm-returns-ebusy.patch gpio-clamp-returned-values-to-the-boolean-range.patch gpio-mvebu-fix-mask-unmask-managment-per-irq-chip-type.patch powerpc-cell-fix-cell-iommu-after-it_page_shift-changes.patch powerpc-fix-missing-l2-cache-size-in-sys-devices-system-cpu.patch powerpc-perf-cap-64bit-userspace-backtraces-to-perf_max_stack_depth.patch scsi-storvsc-fix-a-bug-in-copy_from_bounce_buffer.patch target-file-fix-bug-when-config_debug_sg-y-and-dif-protection-enabled.patch target-file-fix-sg-table-for-prot_buf-initialization.patch target-fix-compare_and_write-with-sg_to_mem_noalloc-handling.patch tools-lib-traceevent-kbuffer-remove-extra-update-to-data-pointer-in-padding.patch tools-power-turbostat-use-curdir-instead-of-pwd-and-add-support-for-o-option-in-makefile.patch ubi-account-for-bitflips-in-both-the-vid-header-and-data.patch ubi-fix-check-for-too-many-bytes.patch ubi-fix-out-of-bounds-write.patch ubi-initialize-leb-number-variable.patch xtensa-iss-fix-locking-in-tap-network-adapter.patch xtensa-provide-__nr_sync_file_range2-instead-of-__nr_sync_file_range.patch xtensa-xtfpga-fix-hardware-lockup-caused-by-lcd-driver.patch --- diff --git a/queue-3.14/acpi-scan-annotate-physical_node_lock-in-acpi_scan_is_offline.patch b/queue-3.14/acpi-scan-annotate-physical_node_lock-in-acpi_scan_is_offline.patch new file mode 100644 index 00000000000..469e72191b0 --- /dev/null +++ b/queue-3.14/acpi-scan-annotate-physical_node_lock-in-acpi_scan_is_offline.patch @@ -0,0 +1,39 @@ +From 4c533c801d1c9b5c38458a0e7516e0cf50643782 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Sat, 18 Apr 2015 01:25:46 +0200 +Subject: ACPI / scan: Annotate physical_node_lock in acpi_scan_is_offline() + +From: "Rafael J. Wysocki" + +commit 4c533c801d1c9b5c38458a0e7516e0cf50643782 upstream. + +acpi_scan_is_offline() may be called under the physical_node_lock +lock of the given device object's parent, so prevent lockdep from +complaining about that by annotating that instance with +SINGLE_DEPTH_NESTING. + +Fixes: caa73ea158de (ACPI / hotplug / driver core: Handle containers in a special way) +Reported-and-tested-by: Xie XiuQi +Reviewed-by: Toshi Kani +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/scan.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -192,7 +192,11 @@ bool acpi_scan_is_offline(struct acpi_de + struct acpi_device_physical_node *pn; + bool offline = true; + +- mutex_lock(&adev->physical_node_lock); ++ /* ++ * acpi_container_offline() calls this for all of the container's ++ * children under the container's physical_node_lock lock. ++ */ ++ mutex_lock_nested(&adev->physical_node_lock, SINGLE_DEPTH_NESTING); + + list_for_each_entry(pn, &adev->physical_node_list, node) + if (device_supports_offline(pn->dev) && !pn->dev->offline) { diff --git a/queue-3.14/acpica-utilities-split-io-address-types-from-data-type-models.patch b/queue-3.14/acpica-utilities-split-io-address-types-from-data-type-models.patch new file mode 100644 index 00000000000..7632edab33b --- /dev/null +++ b/queue-3.14/acpica-utilities-split-io-address-types-from-data-type-models.patch @@ -0,0 +1,110 @@ +From 2b8760100e1de69b6ff004c986328a82947db4ad Mon Sep 17 00:00:00 2001 +From: Lv Zheng +Date: Mon, 13 Apr 2015 11:48:58 +0800 +Subject: ACPICA: Utilities: split IO address types from data type models. + +From: Lv Zheng + +commit 2b8760100e1de69b6ff004c986328a82947db4ad upstream. + +ACPICA commit aacf863cfffd46338e268b7415f7435cae93b451 + +It is reported that on a physically 64-bit addressed machine, 32-bit kernel +can trigger crashes in accessing the memory regions that are beyond the +32-bit boundary. The region field's start address should still be 32-bit +compliant, but after a calculation (adding some offsets), it may exceed the +32-bit boundary. This case is rare and buggy, but there are real BIOSes +leaked with such issues (see References below). + +This patch fixes this gap by always defining IO addresses as 64-bit, and +allows OSPMs to optimize it for a real 32-bit machine to reduce the size of +the internal objects. + +Internal acpi_physical_address usages in the structures that can be fixed +by this change include: + 1. struct acpi_object_region: + acpi_physical_address address; + 2. struct acpi_address_range: + acpi_physical_address start_address; + acpi_physical_address end_address; + 3. struct acpi_mem_space_context; + acpi_physical_address address; + 4. struct acpi_table_desc + acpi_physical_address address; +See known issues 1 for other usages. + +Note that acpi_io_address which is used for ACPI_PROCESSOR may also suffer +from same problem, so this patch changes it accordingly. + +For iasl, it will enforce acpi_physical_address as 32-bit to generate +32-bit OSPM compatible tables on 32-bit platforms, we need to define +ACPI_32BIT_PHYSICAL_ADDRESS for it in acenv.h. + +Known issues: + 1. Cleanup of mapped virtual address + In struct acpi_mem_space_context, acpi_physical_address is used as a virtual + address: + acpi_physical_address mapped_physical_address; + It is better to introduce acpi_virtual_address or use acpi_size instead. + This patch doesn't make such a change. Because this should be done along + with a change to acpi_os_map_memory()/acpi_os_unmap_memory(). + There should be no functional problem to leave this unchanged except + that only this structure is enlarged unexpectedly. + +Link: https://github.com/acpica/acpica/commit/aacf863c +Reference: https://bugzilla.kernel.org/show_bug.cgi?id=87971 +Reference: https://bugzilla.kernel.org/show_bug.cgi?id=79501 +Reported-and-tested-by: Paul Menzel +Reported-and-tested-by: Sial Nije +Signed-off-by: Lv Zheng +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + include/acpi/actypes.h | 20 ++++++++++++++++++++ + include/acpi/platform/acenv.h | 1 + + 2 files changed, 21 insertions(+) + +--- a/include/acpi/actypes.h ++++ b/include/acpi/actypes.h +@@ -198,9 +198,29 @@ typedef int INT32; + typedef s32 acpi_native_int; + + typedef u32 acpi_size; ++ ++#ifdef ACPI_32BIT_PHYSICAL_ADDRESS ++ ++/* ++ * OSPMs can define this to shrink the size of the structures for 32-bit ++ * none PAE environment. ASL compiler may always define this to generate ++ * 32-bit OSPM compliant tables. ++ */ + typedef u32 acpi_io_address; + typedef u32 acpi_physical_address; + ++#else /* ACPI_32BIT_PHYSICAL_ADDRESS */ ++ ++/* ++ * It is reported that, after some calculations, the physical addresses can ++ * wrap over the 32-bit boundary on 32-bit PAE environment. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=87971 ++ */ ++typedef u64 acpi_io_address; ++typedef u64 acpi_physical_address; ++ ++#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */ ++ + #define ACPI_MAX_PTR ACPI_UINT32_MAX + #define ACPI_SIZE_MAX ACPI_UINT32_MAX + +--- a/include/acpi/platform/acenv.h ++++ b/include/acpi/platform/acenv.h +@@ -76,6 +76,7 @@ + #define ACPI_LARGE_NAMESPACE_NODE + #define ACPI_DATA_TABLE_DISASSEMBLY + #define ACPI_SINGLE_THREADED ++#define ACPI_32BIT_PHYSICAL_ADDRESS + #endif + + /* acpi_exec configuration. Multithreaded with full AML debugger */ diff --git a/queue-3.14/asoc-davinci-evm-drop-un-necessary-remove-function.patch b/queue-3.14/asoc-davinci-evm-drop-un-necessary-remove-function.patch new file mode 100644 index 00000000000..4542890e364 --- /dev/null +++ b/queue-3.14/asoc-davinci-evm-drop-un-necessary-remove-function.patch @@ -0,0 +1,45 @@ +From a57069e33fbc6625f39e1b09c88ea44629a35206 Mon Sep 17 00:00:00 2001 +From: Manish Badarkhe +Date: Thu, 26 Mar 2015 15:38:25 +0200 +Subject: ASoC: davinci-evm: drop un-necessary remove function + +From: Manish Badarkhe + +commit a57069e33fbc6625f39e1b09c88ea44629a35206 upstream. + +As davinci card gets registered using 'devm_' api +there is no need to unregister the card in 'remove' +function. +Hence drop the 'remove' function. + +Fixes: ee2f615d6e59c (ASoC: davinci-evm: Add device tree binding) +Signed-off-by: Manish Badarkhe +Signed-off-by: Jyri Sarha +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/davinci/davinci-evm.c | 10 ---------- + 1 file changed, 10 deletions(-) + +--- a/sound/soc/davinci/davinci-evm.c ++++ b/sound/soc/davinci/davinci-evm.c +@@ -384,18 +384,8 @@ static int davinci_evm_probe(struct plat + return ret; + } + +-static int davinci_evm_remove(struct platform_device *pdev) +-{ +- struct snd_soc_card *card = platform_get_drvdata(pdev); +- +- snd_soc_unregister_card(card); +- +- return 0; +-} +- + static struct platform_driver davinci_evm_driver = { + .probe = davinci_evm_probe, +- .remove = davinci_evm_remove, + .driver = { + .name = "davinci_evm", + .owner = THIS_MODULE, diff --git a/queue-3.14/bluetooth-ath3k-add-support-atheros-ar5b195-combo-mini-pcie-card.patch b/queue-3.14/bluetooth-ath3k-add-support-atheros-ar5b195-combo-mini-pcie-card.patch new file mode 100644 index 00000000000..85a511ac37c --- /dev/null +++ b/queue-3.14/bluetooth-ath3k-add-support-atheros-ar5b195-combo-mini-pcie-card.patch @@ -0,0 +1,69 @@ +From 2eeff0b4317a02f0e281df891d990194f0737aae Mon Sep 17 00:00:00 2001 +From: Alexander Ploumistos +Date: Fri, 13 Feb 2015 21:05:11 +0200 +Subject: Bluetooth: ath3k: Add support Atheros AR5B195 combo Mini PCIe card + +From: Alexander Ploumistos + +commit 2eeff0b4317a02f0e281df891d990194f0737aae upstream. + +Add 04f2:aff1 to ath3k.c supported devices list and btusb.c blacklist, so +that the device can load the ath3k firmware and re-enumerate itself as an +AR3011 device. + +T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=04f2 ProdID=aff1 Rev= 0.01 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Alexander Ploumistos +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/ath3k.c | 1 + + drivers/bluetooth/btusb.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -64,6 +64,7 @@ static const struct usb_device_id ath3k_ + /* Atheros AR3011 with sflash firmware*/ + { USB_DEVICE(0x0489, 0xE027) }, + { USB_DEVICE(0x0489, 0xE03D) }, ++ { USB_DEVICE(0x04F2, 0xAFF1) }, + { USB_DEVICE(0x0930, 0x0215) }, + { USB_DEVICE(0x0CF3, 0x3002) }, + { USB_DEVICE(0x0CF3, 0xE019) }, +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -142,6 +142,7 @@ static const struct usb_device_id blackl + /* Atheros 3011 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, ++ { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, diff --git a/queue-3.14/clk-qcom-fix-rcg-m-n-counter-configuration.patch b/queue-3.14/clk-qcom-fix-rcg-m-n-counter-configuration.patch new file mode 100644 index 00000000000..5f8c27203fc --- /dev/null +++ b/queue-3.14/clk-qcom-fix-rcg-m-n-counter-configuration.patch @@ -0,0 +1,44 @@ +From 0b21503dbbfa669dbd847b33578d4041513cddb2 Mon Sep 17 00:00:00 2001 +From: Archit Taneja +Date: Wed, 4 Mar 2015 15:19:35 +0530 +Subject: clk: qcom: fix RCG M/N counter configuration + +From: Archit Taneja + +commit 0b21503dbbfa669dbd847b33578d4041513cddb2 upstream. + +Currently, a RCG's M/N counter (used for fraction division) is +set to either 'bypass' (counter disabled) or 'dual edge' (counter +enabled) based on whether the corresponding rcg struct has a mnd +field specified and a non-zero N. + +In the case where M and N are the same value, the M/N counter is +still enabled by code even though no division takes place. +Leaving the RCG in such a state can result in improper behavior. +This was observed with the DSI pixel clock RCG when M and N were +both set to 1. + +Add an additional check (M != N) to enable the M/N counter only +when it's needed for fraction division. + +Signed-off-by: Archit Taneja +Fixes: bcd61c0f535a (clk: qcom: Add support for root clock +generators (RCGs)) +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/qcom/clk-rcg2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/qcom/clk-rcg2.c ++++ b/drivers/clk/qcom/clk-rcg2.c +@@ -257,7 +257,7 @@ static int __clk_rcg2_set_rate(struct cl + mask |= CFG_SRC_SEL_MASK | CFG_MODE_MASK; + cfg = f->pre_div << CFG_SRC_DIV_SHIFT; + cfg |= rcg->parent_map[f->src] << CFG_SRC_SEL_SHIFT; +- if (rcg->mnd_width && f->n) ++ if (rcg->mnd_width && f->n && (f->m != f->n)) + cfg |= CFG_MODE_DUAL_EDGE; + ret = regmap_update_bits(rcg->clkr.regmap, rcg->cmd_rcgr + CFG_REG, mask, + cfg); diff --git a/queue-3.14/clk-tegra-register-the-proper-number-of-resets.patch b/queue-3.14/clk-tegra-register-the-proper-number-of-resets.patch new file mode 100644 index 00000000000..da5455c5ba5 --- /dev/null +++ b/queue-3.14/clk-tegra-register-the-proper-number-of-resets.patch @@ -0,0 +1,39 @@ +From 5e43e259171e1eee8bc074d9c44be434e685087b Mon Sep 17 00:00:00 2001 +From: Thierry Reding +Date: Mon, 23 Mar 2015 10:57:46 +0100 +Subject: clk: tegra: Register the proper number of resets + +From: Thierry Reding + +commit 5e43e259171e1eee8bc074d9c44be434e685087b upstream. + +The number of resets controls is 32 times the number of peripheral +register banks rather than 32 times the number of clocks. This reduces +(drastically) the number of reset controls registered from 10080 (315 +clocks * 32) to 224 (6 peripheral register banks * 32). + +This also fixes a potential crash because trying to use any of the +excess reset controls (224-10079) would have caused accesses beyond +the array bounds of the peripheral register banks definition array. + +Cc: Peter De Schrijver +Cc: Prashant Gaikwad +Fixes: 6d5b988e7dc5 ("clk: tegra: implement a reset driver") +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/tegra/clk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/tegra/clk.c ++++ b/drivers/clk/tegra/clk.c +@@ -266,7 +266,7 @@ void __init tegra_add_of_provider(struct + of_clk_add_provider(np, of_clk_src_onecell_get, &clk_data); + + rst_ctlr.of_node = np; +- rst_ctlr.nr_resets = clk_num * 32; ++ rst_ctlr.nr_resets = periph_banks * 32; + reset_controller_register(&rst_ctlr); + } + diff --git a/queue-3.14/dm-crypt-fix-deadlock-when-async-crypto-algorithm-returns-ebusy.patch b/queue-3.14/dm-crypt-fix-deadlock-when-async-crypto-algorithm-returns-ebusy.patch new file mode 100644 index 00000000000..eeafa487228 --- /dev/null +++ b/queue-3.14/dm-crypt-fix-deadlock-when-async-crypto-algorithm-returns-ebusy.patch @@ -0,0 +1,79 @@ +From 0618764cb25f6fa9fb31152995de42a8a0496475 Mon Sep 17 00:00:00 2001 +From: Ben Collins +Date: Fri, 3 Apr 2015 16:09:46 +0000 +Subject: dm crypt: fix deadlock when async crypto algorithm returns -EBUSY + +From: Ben Collins + +commit 0618764cb25f6fa9fb31152995de42a8a0496475 upstream. + +I suspect this doesn't show up for most anyone because software +algorithms typically don't have a sense of being too busy. However, +when working with the Freescale CAAM driver it will return -EBUSY on +occasion under heavy -- which resulted in dm-crypt deadlock. + +After checking the logic in some other drivers, the scheme for +crypt_convert() and it's callback, kcryptd_async_done(), were not +correctly laid out to properly handle -EBUSY or -EINPROGRESS. + +Fix this by using the completion for both -EBUSY and -EINPROGRESS. Now +crypt_convert()'s use of completion is comparable to +af_alg_wait_for_completion(). Similarly, kcryptd_async_done() follows +the pattern used in af_alg_complete(). + +Before this fix dm-crypt would lockup within 1-2 minutes running with +the CAAM driver. Fix was regression tested against software algorithms +on PPC32 and x86_64, and things seem perfectly happy there as well. + +Signed-off-by: Ben Collins +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -915,11 +915,10 @@ static int crypt_convert(struct crypt_co + + switch (r) { + /* async */ ++ case -EINPROGRESS: + case -EBUSY: + wait_for_completion(&ctx->restart); + reinit_completion(&ctx->restart); +- /* fall through*/ +- case -EINPROGRESS: + ctx->req = NULL; + ctx->cc_sector++; + continue; +@@ -1314,10 +1313,8 @@ static void kcryptd_async_done(struct cr + struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx); + struct crypt_config *cc = io->cc; + +- if (error == -EINPROGRESS) { +- complete(&ctx->restart); ++ if (error == -EINPROGRESS) + return; +- } + + if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post) + error = cc->iv_gen_ops->post(cc, iv_of_dmreq(cc, dmreq), dmreq); +@@ -1328,12 +1325,15 @@ static void kcryptd_async_done(struct cr + mempool_free(req_of_dmreq(cc, dmreq), cc->req_pool); + + if (!atomic_dec_and_test(&ctx->cc_pending)) +- return; ++ goto done; + + if (bio_data_dir(io->base_bio) == READ) + kcryptd_crypt_read_done(io); + else + kcryptd_crypt_write_io_submit(io, 1); ++done: ++ if (!completion_done(&ctx->restart)) ++ complete(&ctx->restart); + } + + static void kcryptd_crypt(struct work_struct *work) diff --git a/queue-3.14/gpio-clamp-returned-values-to-the-boolean-range.patch b/queue-3.14/gpio-clamp-returned-values-to-the-boolean-range.patch new file mode 100644 index 00000000000..01e63b0b6de --- /dev/null +++ b/queue-3.14/gpio-clamp-returned-values-to-the-boolean-range.patch @@ -0,0 +1,93 @@ +From 23600969ff137cf4c3bc9098f77e381de334e3f7 Mon Sep 17 00:00:00 2001 +From: Alexandre Courbot +Date: Tue, 11 Mar 2014 15:52:09 +0900 +Subject: gpio: clamp returned values to the boolean range + +From: Alexandre Courbot + +commit 23600969ff137cf4c3bc9098f77e381de334e3f7 upstream. + +Nothing prevents GPIO drivers from returning values outside the +boolean range, and as it turns out a few drivers are actually doing so. +These values were passed as-is to unsuspecting consumers and created +confusion. + +This patch makes the internal _gpiod_get_raw_value() function return a +bool, effectively clamping the GPIO value to the boolean range no +matter what the driver does. + +While we are at it, we also change the value parameter of +_gpiod_set_raw_value() to bool type before drivers start doing funny +things with it as well. + +Another way to fix this would be to change the prototypes of the driver +interface to use bool directly, but this would require a huge +cross-systems patch so this simpler solution is preferred. + +Changes since v1: +- Change local variable type to bool as well, use boolean values in + code +- Also change prototype of open drain/open source setting functions + since they are only called from _gpiod_set_raw_value() + +This probably calls for a larger booleanization of gpiolib, but let's +keep that for a latter change - right now we need to address the issue +of non-boolean values returned by drivers. + +Signed-off-by: Alexandre Courbot +Signed-off-by: Linus Walleij +Cc: Vladimir Zapolskiy +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpiolib.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -1928,15 +1928,15 @@ EXPORT_SYMBOL_GPL(gpiod_is_active_low); + * that the GPIO was actually requested. + */ + +-static int _gpiod_get_raw_value(const struct gpio_desc *desc) ++static bool _gpiod_get_raw_value(const struct gpio_desc *desc) + { + struct gpio_chip *chip; +- int value; ++ bool value; + int offset; + + chip = desc->chip; + offset = gpio_chip_hwgpio(desc); +- value = chip->get ? chip->get(chip, offset) : 0; ++ value = chip->get ? chip->get(chip, offset) : false; + trace_gpio_value(desc_to_gpio(desc), 1, value); + return value; + } +@@ -1992,7 +1992,7 @@ EXPORT_SYMBOL_GPL(gpiod_get_value); + * @desc: gpio descriptor whose state need to be set. + * @value: Non-zero for setting it HIGH otherise it will set to LOW. + */ +-static void _gpio_set_open_drain_value(struct gpio_desc *desc, int value) ++static void _gpio_set_open_drain_value(struct gpio_desc *desc, bool value) + { + int err = 0; + struct gpio_chip *chip = desc->chip; +@@ -2019,7 +2019,7 @@ static void _gpio_set_open_drain_value(s + * @desc: gpio descriptor whose state need to be set. + * @value: Non-zero for setting it HIGH otherise it will set to LOW. + */ +-static void _gpio_set_open_source_value(struct gpio_desc *desc, int value) ++static void _gpio_set_open_source_value(struct gpio_desc *desc, bool value) + { + int err = 0; + struct gpio_chip *chip = desc->chip; +@@ -2041,7 +2041,7 @@ static void _gpio_set_open_source_value( + __func__, err); + } + +-static void _gpiod_set_raw_value(struct gpio_desc *desc, int value) ++static void _gpiod_set_raw_value(struct gpio_desc *desc, bool value) + { + struct gpio_chip *chip; + diff --git a/queue-3.14/gpio-mvebu-fix-mask-unmask-managment-per-irq-chip-type.patch b/queue-3.14/gpio-mvebu-fix-mask-unmask-managment-per-irq-chip-type.patch new file mode 100644 index 00000000000..7d496d187c6 --- /dev/null +++ b/queue-3.14/gpio-mvebu-fix-mask-unmask-managment-per-irq-chip-type.patch @@ -0,0 +1,108 @@ +From 61819549f572edd7fce53f228c0d8420cdc85f71 Mon Sep 17 00:00:00 2001 +From: Gregory CLEMENT +Date: Thu, 2 Apr 2015 17:11:11 +0200 +Subject: gpio: mvebu: Fix mask/unmask managment per irq chip type + +From: Gregory CLEMENT + +commit 61819549f572edd7fce53f228c0d8420cdc85f71 upstream. + +Level IRQ handlers and edge IRQ handler are managed by tow different +sets of registers. But currently the driver uses the same mask for the +both registers. It lead to issues with the following scenario: + +First, an IRQ is requested on a GPIO to be triggered on front. After, +this an other IRQ is requested for a GPIO of the same bank but +triggered on level. Then the first one will be also setup to be +triggered on level. It leads to an interrupt storm. + +The different kind of handler are already associated with two +different irq chip type. With this patch the driver uses a private +mask for each one which solves this issue. + +It has been tested on an Armada XP based board and on an Armada 375 +board. For the both boards, with this patch is applied, there is no +such interrupt storm when running the previous scenario. + +This bug was already fixed but in a different way in the legacy +version of this driver by Evgeniy Dushistov: +9ece8839b1277fb9128ff6833411614ab6c88d68 "ARM: orion: Fix for certain +sequence of request_irq can cause irq storm". The fact the new version +of the gpio drive could be affected had been discussed there: +http://thread.gmane.org/gmane.linux.ports.arm.kernel/344670/focus=364012 + +Reported-by: Evgeniy A. Dushistov +Signed-off-by: Gregory CLEMENT +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-mvebu.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +--- a/drivers/gpio/gpio-mvebu.c ++++ b/drivers/gpio/gpio-mvebu.c +@@ -304,11 +304,13 @@ static void mvebu_gpio_edge_irq_mask(str + { + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; ++ struct irq_chip_type *ct = irq_data_get_chip_type(d); + u32 mask = 1 << (d->irq - gc->irq_base); + + irq_gc_lock(gc); +- gc->mask_cache &= ~mask; +- writel_relaxed(gc->mask_cache, mvebu_gpioreg_edge_mask(mvchip)); ++ ct->mask_cache_priv &= ~mask; ++ ++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_edge_mask(mvchip)); + irq_gc_unlock(gc); + } + +@@ -316,11 +318,13 @@ static void mvebu_gpio_edge_irq_unmask(s + { + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; ++ struct irq_chip_type *ct = irq_data_get_chip_type(d); ++ + u32 mask = 1 << (d->irq - gc->irq_base); + + irq_gc_lock(gc); +- gc->mask_cache |= mask; +- writel_relaxed(gc->mask_cache, mvebu_gpioreg_edge_mask(mvchip)); ++ ct->mask_cache_priv |= mask; ++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_edge_mask(mvchip)); + irq_gc_unlock(gc); + } + +@@ -328,11 +332,13 @@ static void mvebu_gpio_level_irq_mask(st + { + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; ++ struct irq_chip_type *ct = irq_data_get_chip_type(d); ++ + u32 mask = 1 << (d->irq - gc->irq_base); + + irq_gc_lock(gc); +- gc->mask_cache &= ~mask; +- writel_relaxed(gc->mask_cache, mvebu_gpioreg_level_mask(mvchip)); ++ ct->mask_cache_priv &= ~mask; ++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_level_mask(mvchip)); + irq_gc_unlock(gc); + } + +@@ -340,11 +346,13 @@ static void mvebu_gpio_level_irq_unmask( + { + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mvebu_gpio_chip *mvchip = gc->private; ++ struct irq_chip_type *ct = irq_data_get_chip_type(d); ++ + u32 mask = 1 << (d->irq - gc->irq_base); + + irq_gc_lock(gc); +- gc->mask_cache |= mask; +- writel_relaxed(gc->mask_cache, mvebu_gpioreg_level_mask(mvchip)); ++ ct->mask_cache_priv |= mask; ++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_level_mask(mvchip)); + irq_gc_unlock(gc); + } + diff --git a/queue-3.14/powerpc-cell-fix-cell-iommu-after-it_page_shift-changes.patch b/queue-3.14/powerpc-cell-fix-cell-iommu-after-it_page_shift-changes.patch new file mode 100644 index 00000000000..01e42d00e2c --- /dev/null +++ b/queue-3.14/powerpc-cell-fix-cell-iommu-after-it_page_shift-changes.patch @@ -0,0 +1,35 @@ +From 7261b956b276aa97fbf60d00f1d7717d2ea6ee78 Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Fri, 3 Apr 2015 14:11:54 +1100 +Subject: powerpc/cell: Fix cell iommu after it_page_shift changes + +From: Michael Ellerman + +commit 7261b956b276aa97fbf60d00f1d7717d2ea6ee78 upstream. + +The patch to add it_page_shift incorrectly changed the increment of +uaddr to use it_page_shift, rather then (1 << it_page_shift). + +This broke booting on at least some Cell blades, as the iommu was +basically non-functional. + +Fixes: 3a553170d35d ("powerpc/iommu: Add it_page_shift field to determine iommu page size") +Signed-off-by: Michael Ellerman +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/cell/iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/platforms/cell/iommu.c ++++ b/arch/powerpc/platforms/cell/iommu.c +@@ -197,7 +197,7 @@ static int tce_build_cell(struct iommu_t + + io_pte = (unsigned long *)tbl->it_base + (index - tbl->it_offset); + +- for (i = 0; i < npages; i++, uaddr += tbl->it_page_shift) ++ for (i = 0; i < npages; i++, uaddr += (1 << tbl->it_page_shift)) + io_pte[i] = base_pte | (__pa(uaddr) & CBE_IOPTE_RPN_Mask); + + mb(); diff --git a/queue-3.14/powerpc-fix-missing-l2-cache-size-in-sys-devices-system-cpu.patch b/queue-3.14/powerpc-fix-missing-l2-cache-size-in-sys-devices-system-cpu.patch new file mode 100644 index 00000000000..325862d5dbf --- /dev/null +++ b/queue-3.14/powerpc-fix-missing-l2-cache-size-in-sys-devices-system-cpu.patch @@ -0,0 +1,104 @@ +From f7e9e358362557c3aa2c1ec47490f29fe880a09e Mon Sep 17 00:00:00 2001 +From: Dave Olson +Date: Thu, 2 Apr 2015 21:28:45 -0700 +Subject: powerpc: Fix missing L2 cache size in /sys/devices/system/cpu + +From: Dave Olson + +commit f7e9e358362557c3aa2c1ec47490f29fe880a09e upstream. + +This problem appears to have been introduced in 2.6.29 by commit +93197a36a9c1 "Rewrite sysfs processor cache info code". + +This caused lscpu to error out on at least e500v2 devices, eg: + + error: cannot open /sys/devices/system/cpu/cpu0/cache/index2/size: No such file or directory + +Some embedded powerpc systems use cache-size in DTS for the unified L2 +cache size, not d-cache-size, so we need to allow for both DTS names. +Added a new CACHE_TYPE_UNIFIED_D cache_type_info structure to handle +this. + +Fixes: 93197a36a9c1 ("powerpc: Rewrite sysfs processor cache info code") +Signed-off-by: Dave Olson +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/cacheinfo.c | 44 ++++++++++++++++++++++++++++++---------- + 1 file changed, 34 insertions(+), 10 deletions(-) + +--- a/arch/powerpc/kernel/cacheinfo.c ++++ b/arch/powerpc/kernel/cacheinfo.c +@@ -61,12 +61,22 @@ struct cache_type_info { + }; + + /* These are used to index the cache_type_info array. */ +-#define CACHE_TYPE_UNIFIED 0 +-#define CACHE_TYPE_INSTRUCTION 1 +-#define CACHE_TYPE_DATA 2 ++#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */ ++#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */ ++#define CACHE_TYPE_INSTRUCTION 2 ++#define CACHE_TYPE_DATA 3 + + static const struct cache_type_info cache_type_info[] = { + { ++ /* Embedded systems that use cache-size, cache-block-size, ++ * etc. for the Unified (typically L2) cache. */ ++ .name = "Unified", ++ .size_prop = "cache-size", ++ .line_size_props = { "cache-line-size", ++ "cache-block-size", }, ++ .nr_sets_prop = "cache-sets", ++ }, ++ { + /* PowerPC Processor binding says the [di]-cache-* + * must be equal on unified caches, so just use + * d-cache properties. */ +@@ -293,7 +303,8 @@ static struct cache *cache_find_first_si + { + struct cache *iter; + +- if (cache->type == CACHE_TYPE_UNIFIED) ++ if (cache->type == CACHE_TYPE_UNIFIED || ++ cache->type == CACHE_TYPE_UNIFIED_D) + return cache; + + list_for_each_entry(iter, &cache_list, list) +@@ -324,16 +335,29 @@ static bool cache_node_is_unified(const + return of_get_property(np, "cache-unified", NULL); + } + +-static struct cache *cache_do_one_devnode_unified(struct device_node *node, +- int level) ++/* ++ * Unified caches can have two different sets of tags. Most embedded ++ * use cache-size, etc. for the unified cache size, but open firmware systems ++ * use d-cache-size, etc. Check on initialization for which type we have, and ++ * return the appropriate structure type. Assume it's embedded if it isn't ++ * open firmware. If it's yet a 3rd type, then there will be missing entries ++ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need ++ * to be extended further. ++ */ ++static int cache_is_unified_d(const struct device_node *np) + { +- struct cache *cache; ++ return of_get_property(np, ++ cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ? ++ CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED; ++} + ++/* ++ */ ++static struct cache *cache_do_one_devnode_unified(struct device_node *node, int level) ++{ + pr_debug("creating L%d ucache for %s\n", level, node->full_name); + +- cache = new_cache(CACHE_TYPE_UNIFIED, level, node); +- +- return cache; ++ return new_cache(cache_is_unified_d(node), level, node); + } + + static struct cache *cache_do_one_devnode_split(struct device_node *node, diff --git a/queue-3.14/powerpc-perf-cap-64bit-userspace-backtraces-to-perf_max_stack_depth.patch b/queue-3.14/powerpc-perf-cap-64bit-userspace-backtraces-to-perf_max_stack_depth.patch new file mode 100644 index 00000000000..5868e4d9e1e --- /dev/null +++ b/queue-3.14/powerpc-perf-cap-64bit-userspace-backtraces-to-perf_max_stack_depth.patch @@ -0,0 +1,31 @@ +From 9a5cbce421a283e6aea3c4007f141735bf9da8c3 Mon Sep 17 00:00:00 2001 +From: Anton Blanchard +Date: Tue, 14 Apr 2015 07:51:03 +1000 +Subject: powerpc/perf: Cap 64bit userspace backtraces to PERF_MAX_STACK_DEPTH + +From: Anton Blanchard + +commit 9a5cbce421a283e6aea3c4007f141735bf9da8c3 upstream. + +We cap 32bit userspace backtraces to PERF_MAX_STACK_DEPTH +(currently 127), but we forgot to do the same for 64bit backtraces. + +Signed-off-by: Anton Blanchard +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/perf/callchain.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/perf/callchain.c ++++ b/arch/powerpc/perf/callchain.c +@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struc + sp = regs->gpr[1]; + perf_callchain_store(entry, next_ip); + +- for (;;) { ++ while (entry->nr < PERF_MAX_STACK_DEPTH) { + fp = (unsigned long __user *) sp; + if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp)) + return; diff --git a/queue-3.14/scsi-storvsc-fix-a-bug-in-copy_from_bounce_buffer.patch b/queue-3.14/scsi-storvsc-fix-a-bug-in-copy_from_bounce_buffer.patch new file mode 100644 index 00000000000..59a4e968f38 --- /dev/null +++ b/queue-3.14/scsi-storvsc-fix-a-bug-in-copy_from_bounce_buffer.patch @@ -0,0 +1,53 @@ +From 8de580742fee8bc34d116f57a20b22b9a5f08403 Mon Sep 17 00:00:00 2001 +From: "K. Y. Srinivasan" +Date: Fri, 27 Mar 2015 00:27:18 -0700 +Subject: scsi: storvsc: Fix a bug in copy_from_bounce_buffer() + +From: "K. Y. Srinivasan" + +commit 8de580742fee8bc34d116f57a20b22b9a5f08403 upstream. + +We may exit this function without properly freeing up the maapings +we may have acquired. Fix the bug. + +Signed-off-by: K. Y. Srinivasan +Reviewed-by: Long Li +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/storvsc_drv.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -739,21 +739,22 @@ static unsigned int copy_to_bounce_buffe + if (bounce_sgl[j].length == PAGE_SIZE) { + /* full..move to next entry */ + sg_kunmap_atomic(bounce_addr); ++ bounce_addr = 0; + j++; ++ } + +- /* if we need to use another bounce buffer */ +- if (srclen || i != orig_sgl_count - 1) +- bounce_addr = sg_kmap_atomic(bounce_sgl,j); ++ /* if we need to use another bounce buffer */ ++ if (srclen && bounce_addr == 0) ++ bounce_addr = sg_kmap_atomic(bounce_sgl, j); + +- } else if (srclen == 0 && i == orig_sgl_count - 1) { +- /* unmap the last bounce that is < PAGE_SIZE */ +- sg_kunmap_atomic(bounce_addr); +- } + } + + sg_kunmap_atomic(src_addr - orig_sgl[i].offset); + } + ++ if (bounce_addr) ++ sg_kunmap_atomic(bounce_addr); ++ + local_irq_restore(flags); + + return total_copied; diff --git a/queue-3.14/series b/queue-3.14/series index 63fae3213d1..b8c31064995 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -46,3 +46,28 @@ arm64-vdso-fix-build-error-when-switching-from-le-to-be.patch bfa-replace-large-udelay-with-mdelay.patch drm-msm-use-componentised-device-support.patch ext4-make-fsync-to-sync-parent-dir-in-no-journal-for-real-this-time.patch +powerpc-perf-cap-64bit-userspace-backtraces-to-perf_max_stack_depth.patch +tools-lib-traceevent-kbuffer-remove-extra-update-to-data-pointer-in-padding.patch +tools-power-turbostat-use-curdir-instead-of-pwd-and-add-support-for-o-option-in-makefile.patch +ubi-account-for-bitflips-in-both-the-vid-header-and-data.patch +ubi-fix-out-of-bounds-write.patch +ubi-initialize-leb-number-variable.patch +ubi-fix-check-for-too-many-bytes.patch +scsi-storvsc-fix-a-bug-in-copy_from_bounce_buffer.patch +target-fix-compare_and_write-with-sg_to_mem_noalloc-handling.patch +target-file-fix-bug-when-config_debug_sg-y-and-dif-protection-enabled.patch +target-file-fix-sg-table-for-prot_buf-initialization.patch +bluetooth-ath3k-add-support-atheros-ar5b195-combo-mini-pcie-card.patch +powerpc-fix-missing-l2-cache-size-in-sys-devices-system-cpu.patch +powerpc-cell-fix-cell-iommu-after-it_page_shift-changes.patch +asoc-davinci-evm-drop-un-necessary-remove-function.patch +acpica-utilities-split-io-address-types-from-data-type-models.patch +acpi-scan-annotate-physical_node_lock-in-acpi_scan_is_offline.patch +xtensa-xtfpga-fix-hardware-lockup-caused-by-lcd-driver.patch +xtensa-provide-__nr_sync_file_range2-instead-of-__nr_sync_file_range.patch +xtensa-iss-fix-locking-in-tap-network-adapter.patch +gpio-mvebu-fix-mask-unmask-managment-per-irq-chip-type.patch +gpio-clamp-returned-values-to-the-boolean-range.patch +clk-tegra-register-the-proper-number-of-resets.patch +clk-qcom-fix-rcg-m-n-counter-configuration.patch +dm-crypt-fix-deadlock-when-async-crypto-algorithm-returns-ebusy.patch diff --git a/queue-3.14/target-file-fix-bug-when-config_debug_sg-y-and-dif-protection-enabled.patch b/queue-3.14/target-file-fix-bug-when-config_debug_sg-y-and-dif-protection-enabled.patch new file mode 100644 index 00000000000..0117882ec67 --- /dev/null +++ b/queue-3.14/target-file-fix-bug-when-config_debug_sg-y-and-dif-protection-enabled.patch @@ -0,0 +1,100 @@ +From 38da0f49e8aa1649af397d53f88e163d0e60c058 Mon Sep 17 00:00:00 2001 +From: Akinobu Mita +Date: Mon, 13 Apr 2015 23:21:56 +0900 +Subject: target/file: Fix BUG() when CONFIG_DEBUG_SG=y and DIF protection enabled + +From: Akinobu Mita + +commit 38da0f49e8aa1649af397d53f88e163d0e60c058 upstream. + +When CONFIG_DEBUG_SG=y and DIF protection support enabled, kernel +BUG()s are triggered due to the following two issues: + +1) prot_sg is not initialized by sg_init_table(). + +When CONFIG_DEBUG_SG=y, scatterlist helpers check sg entry has a +correct magic value. + +2) vmalloc'ed buffer is passed to sg_set_buf(). + +sg_set_buf() uses virt_to_page() to convert virtual address to struct +page, but it doesn't work with vmalloc address. vmalloc_to_page() +should be used instead. As prot_buf isn't usually too large, so +fix it by allocating prot_buf by kmalloc instead of vmalloc. + +Signed-off-by: Akinobu Mita +Cc: Sagi Grimberg +Cc: "Martin K. Petersen" +Cc: Christoph Hellwig +Cc: "James E.J. Bottomley" +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_file.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -273,7 +273,7 @@ static int fd_do_prot_rw(struct se_cmd * + se_dev->prot_length; + + if (!is_write) { +- fd_prot->prot_buf = vzalloc(prot_size); ++ fd_prot->prot_buf = kzalloc(prot_size, GFP_KERNEL); + if (!fd_prot->prot_buf) { + pr_err("Unable to allocate fd_prot->prot_buf\n"); + return -ENOMEM; +@@ -285,9 +285,10 @@ static int fd_do_prot_rw(struct se_cmd * + fd_prot->prot_sg_nents, GFP_KERNEL); + if (!fd_prot->prot_sg) { + pr_err("Unable to allocate fd_prot->prot_sg\n"); +- vfree(fd_prot->prot_buf); ++ kfree(fd_prot->prot_buf); + return -ENOMEM; + } ++ sg_init_table(fd_prot->prot_sg, fd_prot->prot_sg_nents); + size = prot_size; + + for_each_sg(fd_prot->prot_sg, sg, fd_prot->prot_sg_nents, i) { +@@ -317,7 +318,7 @@ static int fd_do_prot_rw(struct se_cmd * + + if (is_write || ret < 0) { + kfree(fd_prot->prot_sg); +- vfree(fd_prot->prot_buf); ++ kfree(fd_prot->prot_buf); + } + + return ret; +@@ -652,11 +653,11 @@ fd_execute_rw(struct se_cmd *cmd, struct + 0, fd_prot.prot_sg, 0); + if (rc) { + kfree(fd_prot.prot_sg); +- vfree(fd_prot.prot_buf); ++ kfree(fd_prot.prot_buf); + return rc; + } + kfree(fd_prot.prot_sg); +- vfree(fd_prot.prot_buf); ++ kfree(fd_prot.prot_buf); + } + } else { + memset(&fd_prot, 0, sizeof(struct fd_prot)); +@@ -672,7 +673,7 @@ fd_execute_rw(struct se_cmd *cmd, struct + 0, fd_prot.prot_sg, 0); + if (rc) { + kfree(fd_prot.prot_sg); +- vfree(fd_prot.prot_buf); ++ kfree(fd_prot.prot_buf); + return rc; + } + } +@@ -703,7 +704,7 @@ fd_execute_rw(struct se_cmd *cmd, struct + + if (ret < 0) { + kfree(fd_prot.prot_sg); +- vfree(fd_prot.prot_buf); ++ kfree(fd_prot.prot_buf); + return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; + } + diff --git a/queue-3.14/target-file-fix-sg-table-for-prot_buf-initialization.patch b/queue-3.14/target-file-fix-sg-table-for-prot_buf-initialization.patch new file mode 100644 index 00000000000..bbd47d6dd76 --- /dev/null +++ b/queue-3.14/target-file-fix-sg-table-for-prot_buf-initialization.patch @@ -0,0 +1,80 @@ +From c836777830428372074d5129ac513e1472c99791 Mon Sep 17 00:00:00 2001 +From: Akinobu Mita +Date: Mon, 13 Apr 2015 23:21:57 +0900 +Subject: target/file: Fix SG table for prot_buf initialization + +From: Akinobu Mita + +commit c836777830428372074d5129ac513e1472c99791 upstream. + +In fd_do_prot_rw(), it allocates prot_buf which is used to copy from +se_cmd->t_prot_sg by sbc_dif_copy_prot(). The SG table for prot_buf +is also initialized by allocating 'se_cmd->t_prot_nents' entries of +scatterlist and setting the data length of each entry to PAGE_SIZE +at most. + +However if se_cmd->t_prot_sg contains a clustered entry (i.e. +sg->length > PAGE_SIZE), the SG table for prot_buf can't be +initialized correctly and sbc_dif_copy_prot() can't copy to prot_buf. +(This actually happened with TCM loopback fabric module) + +As prot_buf is allocated by kzalloc() and it's physically contiguous, +we only need a single scatterlist entry. + +Signed-off-by: Akinobu Mita +Cc: Sagi Grimberg +Cc: "Martin K. Petersen" +Cc: Christoph Hellwig +Cc: "James E.J. Bottomley" +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_file.c | 21 ++++++--------------- + 1 file changed, 6 insertions(+), 15 deletions(-) + +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -263,11 +263,10 @@ static int fd_do_prot_rw(struct se_cmd * + struct se_device *se_dev = cmd->se_dev; + struct fd_dev *dev = FD_DEV(se_dev); + struct file *prot_fd = dev->fd_prot_file; +- struct scatterlist *sg; + loff_t pos = (cmd->t_task_lba * se_dev->prot_length); + unsigned char *buf; +- u32 prot_size, len, size; +- int rc, ret = 1, i; ++ u32 prot_size; ++ int rc, ret = 1; + + prot_size = (cmd->data_length / se_dev->dev_attrib.block_size) * + se_dev->prot_length; +@@ -280,24 +279,16 @@ static int fd_do_prot_rw(struct se_cmd * + } + buf = fd_prot->prot_buf; + +- fd_prot->prot_sg_nents = cmd->t_prot_nents; +- fd_prot->prot_sg = kzalloc(sizeof(struct scatterlist) * +- fd_prot->prot_sg_nents, GFP_KERNEL); ++ fd_prot->prot_sg_nents = 1; ++ fd_prot->prot_sg = kzalloc(sizeof(struct scatterlist), ++ GFP_KERNEL); + if (!fd_prot->prot_sg) { + pr_err("Unable to allocate fd_prot->prot_sg\n"); + kfree(fd_prot->prot_buf); + return -ENOMEM; + } + sg_init_table(fd_prot->prot_sg, fd_prot->prot_sg_nents); +- size = prot_size; +- +- for_each_sg(fd_prot->prot_sg, sg, fd_prot->prot_sg_nents, i) { +- +- len = min_t(u32, PAGE_SIZE, size); +- sg_set_buf(sg, buf, len); +- size -= len; +- buf += len; +- } ++ sg_set_buf(fd_prot->prot_sg, buf, prot_size); + } + + if (is_write) { diff --git a/queue-3.14/target-fix-compare_and_write-with-sg_to_mem_noalloc-handling.patch b/queue-3.14/target-fix-compare_and_write-with-sg_to_mem_noalloc-handling.patch new file mode 100644 index 00000000000..d9370ee40ec --- /dev/null +++ b/queue-3.14/target-fix-compare_and_write-with-sg_to_mem_noalloc-handling.patch @@ -0,0 +1,186 @@ +From c8e639852ad720499912acedfd6b072325fd2807 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Tue, 7 Apr 2015 21:53:27 +0000 +Subject: target: Fix COMPARE_AND_WRITE with SG_TO_MEM_NOALLOC handling + +From: Nicholas Bellinger + +commit c8e639852ad720499912acedfd6b072325fd2807 upstream. + +This patch fixes a bug for COMPARE_AND_WRITE handling with +fabrics using SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC. + +It adds the missing allocation for cmd->t_bidi_data_sg within +transport_generic_new_cmd() that is used by COMPARE_AND_WRITE +for the initial READ payload, even if the fabric is already +providing a pre-allocated buffer for cmd->t_data_sg. + +Also, fix zero-length COMPARE_AND_WRITE handling within the +compare_and_write_callback() and target_complete_ok_work() +to queue the response, skipping the initial READ. + +This fixes COMPARE_AND_WRITE emulation with loopback, vhost, +and xen-backend fabric drivers using SG_TO_MEM_NOALLOC. + +Reported-by: Christoph Hellwig +Cc: Christoph Hellwig +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_sbc.c | 15 ++++++++----- + drivers/target/target_core_transport.c | 37 +++++++++++++++++++++++++++++---- + include/target/target_core_base.h | 2 - + 3 files changed, 44 insertions(+), 10 deletions(-) + +--- a/drivers/target/target_core_sbc.c ++++ b/drivers/target/target_core_sbc.c +@@ -314,7 +314,7 @@ sbc_setup_write_same(struct se_cmd *cmd, + return 0; + } + +-static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd) ++static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success) + { + unsigned char *buf, *addr; + struct scatterlist *sg; +@@ -378,7 +378,7 @@ sbc_execute_rw(struct se_cmd *cmd) + cmd->data_direction); + } + +-static sense_reason_t compare_and_write_post(struct se_cmd *cmd) ++static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success) + { + struct se_device *dev = cmd->se_dev; + +@@ -401,7 +401,7 @@ static sense_reason_t compare_and_write_ + return TCM_NO_SENSE; + } + +-static sense_reason_t compare_and_write_callback(struct se_cmd *cmd) ++static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success) + { + struct se_device *dev = cmd->se_dev; + struct scatterlist *write_sg = NULL, *sg; +@@ -416,11 +416,16 @@ static sense_reason_t compare_and_write_ + + /* + * Handle early failure in transport_generic_request_failure(), +- * which will not have taken ->caw_mutex yet.. ++ * which will not have taken ->caw_sem yet.. + */ +- if (!cmd->t_data_sg || !cmd->t_bidi_data_sg) ++ if (!success && (!cmd->t_data_sg || !cmd->t_bidi_data_sg)) + return TCM_NO_SENSE; + /* ++ * Handle special case for zero-length COMPARE_AND_WRITE ++ */ ++ if (!cmd->data_length) ++ goto out; ++ /* + * Immediately exit + release dev->caw_sem if command has already + * been failed with a non-zero SCSI status. + */ +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -1600,11 +1600,11 @@ void transport_generic_request_failure(s + transport_complete_task_attr(cmd); + /* + * Handle special case for COMPARE_AND_WRITE failure, where the +- * callback is expected to drop the per device ->caw_mutex. ++ * callback is expected to drop the per device ->caw_sem. + */ + if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) && + cmd->transport_complete_callback) +- cmd->transport_complete_callback(cmd); ++ cmd->transport_complete_callback(cmd, false); + + switch (sense_reason) { + case TCM_NON_EXISTENT_LUN: +@@ -1941,8 +1941,12 @@ static void target_complete_ok_work(stru + if (cmd->transport_complete_callback) { + sense_reason_t rc; + +- rc = cmd->transport_complete_callback(cmd); ++ rc = cmd->transport_complete_callback(cmd, true); + if (!rc && !(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE_POST)) { ++ if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) && ++ !cmd->data_length) ++ goto queue_rsp; ++ + return; + } else if (rc) { + ret = transport_send_check_condition_and_sense(cmd, +@@ -1956,6 +1960,7 @@ static void target_complete_ok_work(stru + } + } + ++queue_rsp: + switch (cmd->data_direction) { + case DMA_FROM_DEVICE: + spin_lock(&cmd->se_lun->lun_sep_lock); +@@ -2044,6 +2049,16 @@ static inline void transport_reset_sgl_o + static inline void transport_free_pages(struct se_cmd *cmd) + { + if (cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC) { ++ /* ++ * Release special case READ buffer payload required for ++ * SG_TO_MEM_NOALLOC to function with COMPARE_AND_WRITE ++ */ ++ if (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) { ++ transport_free_sgl(cmd->t_bidi_data_sg, ++ cmd->t_bidi_data_nents); ++ cmd->t_bidi_data_sg = NULL; ++ cmd->t_bidi_data_nents = 0; ++ } + transport_reset_sgl_orig(cmd); + return; + } +@@ -2192,6 +2207,7 @@ sense_reason_t + transport_generic_new_cmd(struct se_cmd *cmd) + { + int ret = 0; ++ bool zero_flag = !(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB); + + /* + * Determine is the TCM fabric module has already allocated physical +@@ -2200,7 +2216,6 @@ transport_generic_new_cmd(struct se_cmd + */ + if (!(cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC) && + cmd->data_length) { +- bool zero_flag = !(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB); + + if ((cmd->se_cmd_flags & SCF_BIDI) || + (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE)) { +@@ -2223,6 +2238,20 @@ transport_generic_new_cmd(struct se_cmd + cmd->data_length, zero_flag); + if (ret < 0) + return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; ++ } else if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) && ++ cmd->data_length) { ++ /* ++ * Special case for COMPARE_AND_WRITE with fabrics ++ * using SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC. ++ */ ++ u32 caw_length = cmd->t_task_nolb * ++ cmd->se_dev->dev_attrib.block_size; ++ ++ ret = target_alloc_sgl(&cmd->t_bidi_data_sg, ++ &cmd->t_bidi_data_nents, ++ caw_length, zero_flag); ++ if (ret < 0) ++ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; + } + /* + * If this command is not a write we can execute it right here, +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -513,7 +513,7 @@ struct se_cmd { + sense_reason_t (*execute_cmd)(struct se_cmd *); + sense_reason_t (*execute_rw)(struct se_cmd *, struct scatterlist *, + u32, enum dma_data_direction); +- sense_reason_t (*transport_complete_callback)(struct se_cmd *); ++ sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool); + + unsigned char *t_task_cdb; + unsigned char __t_task_cdb[TCM_MAX_COMMAND_SIZE]; diff --git a/queue-3.14/tools-lib-traceevent-kbuffer-remove-extra-update-to-data-pointer-in-padding.patch b/queue-3.14/tools-lib-traceevent-kbuffer-remove-extra-update-to-data-pointer-in-padding.patch new file mode 100644 index 00000000000..49fcbe8d62f --- /dev/null +++ b/queue-3.14/tools-lib-traceevent-kbuffer-remove-extra-update-to-data-pointer-in-padding.patch @@ -0,0 +1,39 @@ +From c5e691928bf166ac03430e957038b60adba3cf6c Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Tue, 24 Mar 2015 09:57:55 -0400 +Subject: tools lib traceevent kbuffer: Remove extra update to data pointer in PADDING + +From: "Steven Rostedt (Red Hat)" + +commit c5e691928bf166ac03430e957038b60adba3cf6c upstream. + +When a event PADDING is hit (a deleted event that is still in the ring +buffer), translate_data() sets the length of the padding and also updates +the data pointer which is passed back to the caller. + +This is unneeded because the caller also updates the data pointer with +the passed back length. translate_data() should not update the pointer, +only set the length. + +Signed-off-by: Steven Rostedt +Cc: Andrew Morton +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lkml.kernel.org/r/20150324135923.461431960@goodmis.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/lib/traceevent/kbuffer-parse.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/tools/lib/traceevent/kbuffer-parse.c ++++ b/tools/lib/traceevent/kbuffer-parse.c +@@ -372,7 +372,6 @@ translate_data(struct kbuffer *kbuf, voi + switch (type_len) { + case KBUFFER_TYPE_PADDING: + *length = read_4(kbuf, data); +- data += *length; + break; + + case KBUFFER_TYPE_TIME_EXTEND: diff --git a/queue-3.14/tools-power-turbostat-use-curdir-instead-of-pwd-and-add-support-for-o-option-in-makefile.patch b/queue-3.14/tools-power-turbostat-use-curdir-instead-of-pwd-and-add-support-for-o-option-in-makefile.patch new file mode 100644 index 00000000000..544ba2a60e8 --- /dev/null +++ b/queue-3.14/tools-power-turbostat-use-curdir-instead-of-pwd-and-add-support-for-o-option-in-makefile.patch @@ -0,0 +1,55 @@ +From f82263c6989c31ae9b94cecddffb29dcbec38710 Mon Sep 17 00:00:00 2001 +From: Thomas D +Date: Mon, 5 Jan 2015 21:37:23 +0100 +Subject: tools/power turbostat: Use $(CURDIR) instead of $(PWD) and add support for O= option in Makefile + +From: Thomas D + +commit f82263c6989c31ae9b94cecddffb29dcbec38710 upstream. + +Since commit ee0778a30153 +("tools/power: turbostat: make Makefile a bit more capable") +turbostat's Makefile is using + + [...] + BUILD_OUTPUT := $(PWD) + [...] + +which obviously causes trouble when building "turbostat" with + + make -C /usr/src/linux/tools/power/x86/turbostat ARCH=x86 turbostat + +because GNU make does not update nor guarantee that $PWD is set. + +This patch changes the Makefile to use $CURDIR instead, which GNU make +guarantees to set and update (i.e. when using "make -C ...") and also +adds support for the O= option (see "make help" in your root of your +kernel source tree for more details). + +Link: https://bugs.gentoo.org/show_bug.cgi?id=533918 +Fixes: ee0778a30153 ("tools/power: turbostat: make Makefile a bit more capable") +Signed-off-by: Thomas D. +Cc: Mark Asselstine +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + tools/power/x86/turbostat/Makefile | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/tools/power/x86/turbostat/Makefile ++++ b/tools/power/x86/turbostat/Makefile +@@ -1,8 +1,12 @@ + CC = $(CROSS_COMPILE)gcc +-BUILD_OUTPUT := $(PWD) ++BUILD_OUTPUT := $(CURDIR) + PREFIX := /usr + DESTDIR := + ++ifeq ("$(origin O)", "command line") ++ BUILD_OUTPUT := $(O) ++endif ++ + turbostat : turbostat.c + CFLAGS += -Wall + CFLAGS += -DMSRHEADER='"../../../../arch/x86/include/uapi/asm/msr-index.h"' diff --git a/queue-3.14/ubi-account-for-bitflips-in-both-the-vid-header-and-data.patch b/queue-3.14/ubi-account-for-bitflips-in-both-the-vid-header-and-data.patch new file mode 100644 index 00000000000..9029cfb013f --- /dev/null +++ b/queue-3.14/ubi-account-for-bitflips-in-both-the-vid-header-and-data.patch @@ -0,0 +1,34 @@ +From 8eef7d70f7c6772c3490f410ee2bceab3b543fa1 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Sat, 28 Feb 2015 02:23:25 -0800 +Subject: UBI: account for bitflips in both the VID header and data + +From: Brian Norris + +commit 8eef7d70f7c6772c3490f410ee2bceab3b543fa1 upstream. + +We are completely discarding the earlier value of 'bitflips', which +could reflect a bitflip found in ubi_io_read_vid_hdr(). Let's use the +bitwise OR of header and data 'bitflip' statuses instead. + +Coverity CID #1226856 + +Signed-off-by: Brian Norris +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/ubi/attach.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/ubi/attach.c ++++ b/drivers/mtd/ubi/attach.c +@@ -408,7 +408,7 @@ int ubi_compare_lebs(struct ubi_device * + second_is_newer = !second_is_newer; + } else { + dbg_bld("PEB %d CRC is OK", pnum); +- bitflips = !!err; ++ bitflips |= !!err; + } + mutex_unlock(&ubi->buf_mutex); + diff --git a/queue-3.14/ubi-fix-check-for-too-many-bytes.patch b/queue-3.14/ubi-fix-check-for-too-many-bytes.patch new file mode 100644 index 00000000000..18e99fb12c5 --- /dev/null +++ b/queue-3.14/ubi-fix-check-for-too-many-bytes.patch @@ -0,0 +1,35 @@ +From 299d0c5b27346a77a0777c993372bf8777d4f2e5 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Sat, 28 Feb 2015 02:23:28 -0800 +Subject: UBI: fix check for "too many bytes" + +From: Brian Norris + +commit 299d0c5b27346a77a0777c993372bf8777d4f2e5 upstream. + +The comparison from the previous line seems to have been erroneously +(partially) copied-and-pasted onto the next. The second line should be +checking req.bytes, not req.lnum. + +Coverity CID #139400 + +Signed-off-by: Brian Norris +[rw: Fixed comparison] +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/ubi/cdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/ubi/cdev.c ++++ b/drivers/mtd/ubi/cdev.c +@@ -451,7 +451,7 @@ static long vol_cdev_ioctl(struct file * + /* Validate the request */ + err = -EINVAL; + if (req.lnum < 0 || req.lnum >= vol->reserved_pebs || +- req.bytes < 0 || req.lnum >= vol->usable_leb_size) ++ req.bytes < 0 || req.bytes > vol->usable_leb_size) + break; + + err = get_exclusive(desc); diff --git a/queue-3.14/ubi-fix-out-of-bounds-write.patch b/queue-3.14/ubi-fix-out-of-bounds-write.patch new file mode 100644 index 00000000000..c6b45c8a14a --- /dev/null +++ b/queue-3.14/ubi-fix-out-of-bounds-write.patch @@ -0,0 +1,34 @@ +From d74adbdb9abf0d2506a6c4afa534d894f28b763f Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Sat, 28 Feb 2015 02:23:26 -0800 +Subject: UBI: fix out of bounds write + +From: Brian Norris + +commit d74adbdb9abf0d2506a6c4afa534d894f28b763f upstream. + +If aeb->len >= vol->reserved_pebs, we should not be writing aeb into the +PEB->LEB mapping. + +Caught by Coverity, CID #711212. + +Signed-off-by: Brian Norris +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/ubi/eba.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/ubi/eba.c ++++ b/drivers/mtd/ubi/eba.c +@@ -1362,7 +1362,8 @@ int ubi_eba_init(struct ubi_device *ubi, + * during re-size. + */ + ubi_move_aeb_to_list(av, aeb, &ai->erase); +- vol->eba_tbl[aeb->lnum] = aeb->pnum; ++ else ++ vol->eba_tbl[aeb->lnum] = aeb->pnum; + } + } + diff --git a/queue-3.14/ubi-initialize-leb-number-variable.patch b/queue-3.14/ubi-initialize-leb-number-variable.patch new file mode 100644 index 00000000000..bcc8f14bc2d --- /dev/null +++ b/queue-3.14/ubi-initialize-leb-number-variable.patch @@ -0,0 +1,38 @@ +From f16db8071ce18819fbd705ddcc91c6f392fb61f8 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Sat, 28 Feb 2015 02:23:27 -0800 +Subject: UBI: initialize LEB number variable + +From: Brian Norris + +commit f16db8071ce18819fbd705ddcc91c6f392fb61f8 upstream. + +In some of the 'out_not_moved' error paths, lnum may be used +uninitialized. Don't ignore the warning; let's fix it. + +This uninitialized variable doesn't have much visible effect in the end, +since we just schedule the PEB for erasure, and its LEB number doesn't +really matter (it just gets printed in debug messages). But let's get it +straight anyway. + +Coverity CID #113449 + +Signed-off-by: Brian Norris +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/ubi/wl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -995,7 +995,7 @@ static int wear_leveling_worker(struct u + int cancel) + { + int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0; +- int vol_id = -1, uninitialized_var(lnum); ++ int vol_id = -1, lnum = -1; + #ifdef CONFIG_MTD_UBI_FASTMAP + int anchor = wrk->anchor; + #endif diff --git a/queue-3.14/xtensa-iss-fix-locking-in-tap-network-adapter.patch b/queue-3.14/xtensa-iss-fix-locking-in-tap-network-adapter.patch new file mode 100644 index 00000000000..624a6da2635 --- /dev/null +++ b/queue-3.14/xtensa-iss-fix-locking-in-tap-network-adapter.patch @@ -0,0 +1,136 @@ +From 24e94454c8cb6a13634f5a2f5a01da53a546a58d Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Fri, 3 Apr 2015 09:56:21 +0300 +Subject: xtensa: ISS: fix locking in TAP network adapter + +From: Max Filippov + +commit 24e94454c8cb6a13634f5a2f5a01da53a546a58d upstream. + +- don't lock lp->lock in the iss_net_timer for the call of iss_net_poll, + it will lock it itself; +- invert order of lp->lock and opened_lock acquisition in the + iss_net_open to make it consistent with iss_net_poll; +- replace spin_lock with spin_lock_bh when acquiring locks used in + iss_net_timer from non-atomic context; +- replace spin_lock_irqsave with spin_lock_bh in the iss_net_start_xmit + as the driver doesn't use lp->lock in the hard IRQ context; +- replace __SPIN_LOCK_UNLOCKED(lp.lock) with spin_lock_init, otherwise + lockdep is unhappy about using non-static key. + +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/xtensa/platforms/iss/network.c | 29 +++++++++++++++-------------- + 1 file changed, 15 insertions(+), 14 deletions(-) + +--- a/arch/xtensa/platforms/iss/network.c ++++ b/arch/xtensa/platforms/iss/network.c +@@ -349,8 +349,8 @@ static void iss_net_timer(unsigned long + { + struct iss_net_private *lp = (struct iss_net_private *)priv; + +- spin_lock(&lp->lock); + iss_net_poll(); ++ spin_lock(&lp->lock); + mod_timer(&lp->timer, jiffies + lp->timer_val); + spin_unlock(&lp->lock); + } +@@ -361,7 +361,7 @@ static int iss_net_open(struct net_devic + struct iss_net_private *lp = netdev_priv(dev); + int err; + +- spin_lock(&lp->lock); ++ spin_lock_bh(&lp->lock); + + err = lp->tp.open(lp); + if (err < 0) +@@ -376,9 +376,11 @@ static int iss_net_open(struct net_devic + while ((err = iss_net_rx(dev)) > 0) + ; + +- spin_lock(&opened_lock); ++ spin_unlock_bh(&lp->lock); ++ spin_lock_bh(&opened_lock); + list_add(&lp->opened_list, &opened); +- spin_unlock(&opened_lock); ++ spin_unlock_bh(&opened_lock); ++ spin_lock_bh(&lp->lock); + + init_timer(&lp->timer); + lp->timer_val = ISS_NET_TIMER_VALUE; +@@ -387,7 +389,7 @@ static int iss_net_open(struct net_devic + mod_timer(&lp->timer, jiffies + lp->timer_val); + + out: +- spin_unlock(&lp->lock); ++ spin_unlock_bh(&lp->lock); + return err; + } + +@@ -395,7 +397,7 @@ static int iss_net_close(struct net_devi + { + struct iss_net_private *lp = netdev_priv(dev); + netif_stop_queue(dev); +- spin_lock(&lp->lock); ++ spin_lock_bh(&lp->lock); + + spin_lock(&opened_lock); + list_del(&opened); +@@ -405,18 +407,17 @@ static int iss_net_close(struct net_devi + + lp->tp.close(lp); + +- spin_unlock(&lp->lock); ++ spin_unlock_bh(&lp->lock); + return 0; + } + + static int iss_net_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct iss_net_private *lp = netdev_priv(dev); +- unsigned long flags; + int len; + + netif_stop_queue(dev); +- spin_lock_irqsave(&lp->lock, flags); ++ spin_lock_bh(&lp->lock); + + len = lp->tp.write(lp, &skb); + +@@ -438,7 +439,7 @@ static int iss_net_start_xmit(struct sk_ + pr_err("%s: %s failed(%d)\n", dev->name, __func__, len); + } + +- spin_unlock_irqrestore(&lp->lock, flags); ++ spin_unlock_bh(&lp->lock); + + dev_kfree_skb(skb); + return NETDEV_TX_OK; +@@ -466,9 +467,9 @@ static int iss_net_set_mac(struct net_de + + if (!is_valid_ether_addr(hwaddr->sa_data)) + return -EADDRNOTAVAIL; +- spin_lock(&lp->lock); ++ spin_lock_bh(&lp->lock); + memcpy(dev->dev_addr, hwaddr->sa_data, ETH_ALEN); +- spin_unlock(&lp->lock); ++ spin_unlock_bh(&lp->lock); + return 0; + } + +@@ -520,11 +521,11 @@ static int iss_net_configure(int index, + *lp = (struct iss_net_private) { + .device_list = LIST_HEAD_INIT(lp->device_list), + .opened_list = LIST_HEAD_INIT(lp->opened_list), +- .lock = __SPIN_LOCK_UNLOCKED(lp.lock), + .dev = dev, + .index = index, +- }; ++ }; + ++ spin_lock_init(&lp->lock); + /* + * If this name ends up conflicting with an existing registered + * netdevice, that is OK, register_netdev{,ice}() will notice this diff --git a/queue-3.14/xtensa-provide-__nr_sync_file_range2-instead-of-__nr_sync_file_range.patch b/queue-3.14/xtensa-provide-__nr_sync_file_range2-instead-of-__nr_sync_file_range.patch new file mode 100644 index 00000000000..1eae3243766 --- /dev/null +++ b/queue-3.14/xtensa-provide-__nr_sync_file_range2-instead-of-__nr_sync_file_range.patch @@ -0,0 +1,35 @@ +From 01e84c70fe40c8111f960987bcf7f931842e6d07 Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Fri, 27 Feb 2015 11:02:38 +0300 +Subject: xtensa: provide __NR_sync_file_range2 instead of __NR_sync_file_range + +From: Max Filippov + +commit 01e84c70fe40c8111f960987bcf7f931842e6d07 upstream. + +xtensa actually uses sync_file_range2 implementation, so it should +define __NR_sync_file_range2 as other architectures that use that +function. That fixes userspace interface (that apparently never worked) +and avoids special-casing xtensa in libc implementations. +See the thread ending at +http://lists.busybox.net/pipermail/uclibc/2015-February/048833.html +for more details. + +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/xtensa/include/uapi/asm/unistd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/xtensa/include/uapi/asm/unistd.h ++++ b/arch/xtensa/include/uapi/asm/unistd.h +@@ -715,7 +715,7 @@ __SYSCALL(323, sys_process_vm_writev, 6) + __SYSCALL(324, sys_name_to_handle_at, 5) + #define __NR_open_by_handle_at 325 + __SYSCALL(325, sys_open_by_handle_at, 3) +-#define __NR_sync_file_range 326 ++#define __NR_sync_file_range2 326 + __SYSCALL(326, sys_sync_file_range2, 6) + #define __NR_perf_event_open 327 + __SYSCALL(327, sys_perf_event_open, 5) diff --git a/queue-3.14/xtensa-xtfpga-fix-hardware-lockup-caused-by-lcd-driver.patch b/queue-3.14/xtensa-xtfpga-fix-hardware-lockup-caused-by-lcd-driver.patch new file mode 100644 index 00000000000..0731695dc07 --- /dev/null +++ b/queue-3.14/xtensa-xtfpga-fix-hardware-lockup-caused-by-lcd-driver.patch @@ -0,0 +1,227 @@ +From 4949009eb8d40a441dcddcd96e101e77d31cf1b2 Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Fri, 27 Feb 2015 06:28:00 +0300 +Subject: xtensa: xtfpga: fix hardware lockup caused by LCD driver + +From: Max Filippov + +commit 4949009eb8d40a441dcddcd96e101e77d31cf1b2 upstream. + +LCD driver is always built for the XTFPGA platform, but its base address +is not configurable, and is wrong for ML605/KC705. Its initialization +locks up KC705 board hardware. + +Make the whole driver optional, and its base address and bus width +configurable. Implement 4-bit bus access method. + +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/xtensa/Kconfig | 30 ++++++++ + arch/xtensa/platforms/xtfpga/Makefile | 3 + arch/xtensa/platforms/xtfpga/include/platform/hardware.h | 3 + arch/xtensa/platforms/xtfpga/include/platform/lcd.h | 15 ++++ + arch/xtensa/platforms/xtfpga/lcd.c | 55 +++++++++------ + 5 files changed, 81 insertions(+), 25 deletions(-) + +--- a/arch/xtensa/Kconfig ++++ b/arch/xtensa/Kconfig +@@ -336,6 +336,36 @@ menu "Executable file formats" + + source "fs/Kconfig.binfmt" + ++config XTFPGA_LCD ++ bool "Enable XTFPGA LCD driver" ++ depends on XTENSA_PLATFORM_XTFPGA ++ default n ++ help ++ There's a 2x16 LCD on most of XTFPGA boards, kernel may output ++ progress messages there during bootup/shutdown. It may be useful ++ during board bringup. ++ ++ If unsure, say N. ++ ++config XTFPGA_LCD_BASE_ADDR ++ hex "XTFPGA LCD base address" ++ depends on XTFPGA_LCD ++ default "0x0d0c0000" ++ help ++ Base address of the LCD controller inside KIO region. ++ Different boards from XTFPGA family have LCD controller at different ++ addresses. Please consult prototyping user guide for your board for ++ the correct address. Wrong address here may lead to hardware lockup. ++ ++config XTFPGA_LCD_8BIT_ACCESS ++ bool "Use 8-bit access to XTFPGA LCD" ++ depends on XTFPGA_LCD ++ default n ++ help ++ LCD may be connected with 4- or 8-bit interface, 8-bit access may ++ only be used with 8-bit interface. Please consult prototyping user ++ guide for your board for the correct interface width. ++ + endmenu + + source "net/Kconfig" +--- a/arch/xtensa/platforms/xtfpga/Makefile ++++ b/arch/xtensa/platforms/xtfpga/Makefile +@@ -6,4 +6,5 @@ + # + # Note 2! The CFLAGS definitions are in the main makefile... + +-obj-y = setup.o lcd.o ++obj-y += setup.o ++obj-$(CONFIG_XTFPGA_LCD) += lcd.o +--- a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h ++++ b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h +@@ -40,9 +40,6 @@ + + /* UART */ + #define DUART16552_PADDR (XCHAL_KIO_PADDR + 0x0D050020) +-/* LCD instruction and data addresses. */ +-#define LCD_INSTR_ADDR ((char *)IOADDR(0x0D040000)) +-#define LCD_DATA_ADDR ((char *)IOADDR(0x0D040004)) + + /* Misc. */ + #define XTFPGA_FPGAREGS_VADDR IOADDR(0x0D020000) +--- a/arch/xtensa/platforms/xtfpga/include/platform/lcd.h ++++ b/arch/xtensa/platforms/xtfpga/include/platform/lcd.h +@@ -11,10 +11,25 @@ + #ifndef __XTENSA_XTAVNET_LCD_H + #define __XTENSA_XTAVNET_LCD_H + ++#ifdef CONFIG_XTFPGA_LCD + /* Display string STR at position POS on the LCD. */ + void lcd_disp_at_pos(char *str, unsigned char pos); + + /* Shift the contents of the LCD display left or right. */ + void lcd_shiftleft(void); + void lcd_shiftright(void); ++#else ++static inline void lcd_disp_at_pos(char *str, unsigned char pos) ++{ ++} ++ ++static inline void lcd_shiftleft(void) ++{ ++} ++ ++static inline void lcd_shiftright(void) ++{ ++} ++#endif ++ + #endif +--- a/arch/xtensa/platforms/xtfpga/lcd.c ++++ b/arch/xtensa/platforms/xtfpga/lcd.c +@@ -1,50 +1,63 @@ + /* +- * Driver for the LCD display on the Tensilica LX60 Board. ++ * Driver for the LCD display on the Tensilica XTFPGA board family. ++ * http://www.mytechcorp.com/cfdata/productFile/File1/MOC-16216B-B-A0A04.pdf + * + * This file is subject to the terms and conditions of the GNU General Public + * License. See the file "COPYING" in the main directory of this archive + * for more details. + * + * Copyright (C) 2001, 2006 Tensilica Inc. ++ * Copyright (C) 2015 Cadence Design Systems Inc. + */ + +-/* +- * +- * FIXME: this code is from the examples from the LX60 user guide. +- * +- * The lcd_pause function does busy waiting, which is probably not +- * great. Maybe the code could be changed to use kernel timers, or +- * change the hardware to not need to wait. +- */ +- ++#include + #include + #include + + #include + #include +-#include + +-#define LCD_PAUSE_ITERATIONS 4000 ++/* LCD instruction and data addresses. */ ++#define LCD_INSTR_ADDR ((char *)IOADDR(CONFIG_XTFPGA_LCD_BASE_ADDR)) ++#define LCD_DATA_ADDR (LCD_INSTR_ADDR + 4) ++ + #define LCD_CLEAR 0x1 + #define LCD_DISPLAY_ON 0xc + + /* 8bit and 2 lines display */ + #define LCD_DISPLAY_MODE8BIT 0x38 ++#define LCD_DISPLAY_MODE4BIT 0x28 + #define LCD_DISPLAY_POS 0x80 + #define LCD_SHIFT_LEFT 0x18 + #define LCD_SHIFT_RIGHT 0x1c + ++static void lcd_put_byte(u8 *addr, u8 data) ++{ ++#ifdef CONFIG_XTFPGA_LCD_8BIT_ACCESS ++ ACCESS_ONCE(*addr) = data; ++#else ++ ACCESS_ONCE(*addr) = data & 0xf0; ++ ACCESS_ONCE(*addr) = (data << 4) & 0xf0; ++#endif ++} ++ + static int __init lcd_init(void) + { +- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT; ++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT; + mdelay(5); +- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT; ++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT; + udelay(200); +- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT; ++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT; ++ udelay(50); ++#ifndef CONFIG_XTFPGA_LCD_8BIT_ACCESS ++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE4BIT; ++ udelay(50); ++ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_MODE4BIT); + udelay(50); +- *LCD_INSTR_ADDR = LCD_DISPLAY_ON; ++#endif ++ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_ON); + udelay(50); +- *LCD_INSTR_ADDR = LCD_CLEAR; ++ lcd_put_byte(LCD_INSTR_ADDR, LCD_CLEAR); + mdelay(10); + lcd_disp_at_pos("XTENSA LINUX", 0); + return 0; +@@ -52,10 +65,10 @@ static int __init lcd_init(void) + + void lcd_disp_at_pos(char *str, unsigned char pos) + { +- *LCD_INSTR_ADDR = LCD_DISPLAY_POS | pos; ++ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_POS | pos); + udelay(100); + while (*str != 0) { +- *LCD_DATA_ADDR = *str; ++ lcd_put_byte(LCD_DATA_ADDR, *str); + udelay(200); + str++; + } +@@ -63,13 +76,13 @@ void lcd_disp_at_pos(char *str, unsigned + + void lcd_shiftleft(void) + { +- *LCD_INSTR_ADDR = LCD_SHIFT_LEFT; ++ lcd_put_byte(LCD_INSTR_ADDR, LCD_SHIFT_LEFT); + udelay(50); + } + + void lcd_shiftright(void) + { +- *LCD_INSTR_ADDR = LCD_SHIFT_RIGHT; ++ lcd_put_byte(LCD_INSTR_ADDR, LCD_SHIFT_RIGHT); + udelay(50); + } +